Remote Senior App Security Engineer: DevSecOps & AI Tools

American Express Global Business Travel; Boise (ID); On-site; USD 104,000 - 194,000; Full time

Benefits offered by this job

Flexible benefits

Travel perks

Learning and development programs

Job summary

Amex GBT in the United States is seeking an experienced Senior Application Security Engineer to join our cloud-native security program. This remote role blends application development with security, mentoring others while shaping secure software governance and practices.

You’ll collaborate with DevOps to secure pipelines, implement automated scanning, and guide teams on secure coding and AI-tool risk management, aligning with PCI-DSS, GDPR, and SOC 2 standards.

Qualifications

• 5+ years of professional software development with security focus.
• 3+ years in application security or DevSecOps.
• Strong knowledge of OWASP Top 10 and API security.

Responsibilities

• Design, implement, and maintain secure CI/CD pipelines with integrated security testing.
• Deploy and tune SAST/DAST, SCA, and container scanning.
• Govern API security and centralize findings for reporting.
• Promote secure coding practices across teams.
• Evaluate agentic AI coding tools and establish guardrails.
• Ensure PCI-DSS, GDPR, SOC 2 compliance as applicable.
• Build KPI reporting for application security initiatives.
• Mentor junior engineers and foster a security-first culture.

Skills

Python

Go

Java

JavaScript/TypeScript

OWASP Top 10

API security

DevSecOps

Secure coding practices

Threat modeling

Mentoring

Education

Bachelor's degree in Computer Science or related

Security certifications (CISSP/GIAC/OSCP or AWS/Azure Security)

Tools

SAST/DAST scanners

WAF

CI/CD tools

Terraform

Docker

Kubernetes

IAM / Secrets management

Git/GitHub/GitLab

Job description

Amex GBT in the United States is seeking an experienced Senior Application Security Engineer to join our cloud-native security program. This remote role blends application development with security, mentoring others while shaping secure software governance and practices.

You’ll collaborate with DevOps to secure pipelines, implement automated scanning, and guide teams on secure coding and AI-tool risk management, aligning with PCI-DSS, GDPR, and SOC 2 standards.